{"id":"https://openalex.org/W7169588553","doi":"https://doi.org/10.1145/3803437.3805205","title":"Lessons from Mitigating False Positives in Google's OSS-Fuzz-Gen","display_name":"Lessons from Mitigating False Positives in Google's OSS-Fuzz-Gen","publication_year":2026,"publication_date":"2026-07-05","ids":{"openalex":"https://openalex.org/W7169588553","doi":"https://doi.org/10.1145/3803437.3805205"},"language":null,"primary_location":{"id":"doi:10.1145/3803437.3805205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803437.3805205","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3803437.3805205","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5001434147","display_name":"Paschal Amusuo","orcid":null},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Paschal Amusuo","raw_affiliation_strings":["Purdue University, West Lafayette, Indiana, USA"],"raw_orcid":"https://orcid.org/0000-0003-1001-525X","affiliations":[{"raw_affiliation_string":"Purdue University, West Lafayette, Indiana, USA","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047563854","display_name":"Dongge Liu","orcid":"https://orcid.org/0000-0003-4821-7033"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dongge Liu","raw_affiliation_strings":["Google, Melbourne, Australia"],"raw_orcid":"https://orcid.org/0000-0003-4821-7033","affiliations":[{"raw_affiliation_string":"Google, Melbourne, Australia","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112986438","display_name":"Ricardo Andr\u00e9s Calvo M\u00e9ndez","orcid":null},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ricardo Andres Calvo Mendez","raw_affiliation_strings":["Purdue University, West Lafayette, Indiana, USA"],"raw_orcid":"https://orcid.org/0009-0003-6681-4840","affiliations":[{"raw_affiliation_string":"Purdue University, West Lafayette, Indiana, USA","institution_ids":["https://openalex.org/I219193219"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057538904","display_name":"Jonathan Metzman","orcid":"https://orcid.org/0000-0002-7042-0444"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jonathan Metzman","raw_affiliation_strings":["Google, New York City, New York, USA"],"raw_orcid":"https://orcid.org/0000-0002-7042-0444","affiliations":[{"raw_affiliation_string":"Google, New York City, New York, USA","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135185301","display_name":"Oliver Chang","orcid":"https://orcid.org/0009-0006-3181-4551"},"institutions":[{"id":"https://openalex.org/I1291425158","display_name":"Google (United States)","ror":"https://ror.org/00njsd438","country_code":"US","type":"company","lineage":["https://openalex.org/I1291425158","https://openalex.org/I4210128969"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Oliver Chang","raw_affiliation_strings":["Google, Melbourne, Australia"],"raw_orcid":"https://orcid.org/0009-0006-3181-4551","affiliations":[{"raw_affiliation_string":"Google, Melbourne, Australia","institution_ids":["https://openalex.org/I1291425158"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5013948143","display_name":"James C. Davis","orcid":"https://orcid.org/0000-0003-2495-686X"},"institutions":[{"id":"https://openalex.org/I219193219","display_name":"Purdue University West Lafayette","ror":"https://ror.org/02dqehb95","country_code":"US","type":"education","lineage":["https://openalex.org/I219193219"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"James C Davis","raw_affiliation_strings":["Purdue University, West Lafayette, Indiana, USA"],"raw_orcid":"https://orcid.org/0000-0003-2495-686X","affiliations":[{"raw_affiliation_string":"Purdue University, West Lafayette, Indiana, USA","institution_ids":["https://openalex.org/I219193219"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"316","last_page":"321"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":null,"topics":[],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9623000025749207},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.6674000024795532},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.5184999704360962},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.436599999666214},{"id":"https://openalex.org/keywords/crash","display_name":"Crash","score":0.4223000109195709},{"id":"https://openalex.org/keywords/false-positives-and-false-negatives","display_name":"False positives and false negatives","score":0.3571000099182129}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9623000025749207},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.6674000024795532},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.5184999704360962},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4846999943256378},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.436599999666214},{"id":"https://openalex.org/C183469790","wikidata":"https://www.wikidata.org/wiki/Q333501","display_name":"Crash","level":2,"score":0.4223000109195709},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.3666999936103821},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.3571000099182129},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.3370000123977661},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3206999897956848},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3181999921798706},{"id":"https://openalex.org/C2778348673","wikidata":"https://www.wikidata.org/wiki/Q739302","display_name":"Production (economics)","level":2,"score":0.2896000146865845},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.28299999237060547},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2768999934196472},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27379998564720154},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C106436119","wikidata":"https://www.wikidata.org/wiki/Q836575","display_name":"Quality assurance","level":3,"score":0.2506999969482422}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3803437.3805205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803437.3805205","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3803437.3805205","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3803437.3805205","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 34th ACM International Conference on the Foundations of Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W2002934700","https://openalex.org/W2405195981","https://openalex.org/W2963298680","https://openalex.org/W2979357014","https://openalex.org/W3173990398","https://openalex.org/W4233410239","https://openalex.org/W4384163171","https://openalex.org/W4388240263","https://openalex.org/W4388502423","https://openalex.org/W4401724691","https://openalex.org/W4402263795","https://openalex.org/W4402265102","https://openalex.org/W4402442582","https://openalex.org/W4404354533","https://openalex.org/W4405182882","https://openalex.org/W4411173024","https://openalex.org/W4411272183","https://openalex.org/W4411552763","https://openalex.org/W4416549437","https://openalex.org/W4417088149","https://openalex.org/W6967239349","https://openalex.org/W7080122599","https://openalex.org/W7148388643","https://openalex.org/W7160925737"],"related_works":[],"abstract_inverted_index":{"Fuzz":[0],"testing":[1],"is":[2],"widely":[3],"used":[4],"in":[5,37,119],"industry":[6],"and":[7,76],"open-source":[8],"ecosystems,":[9],"but":[10,36],"its":[11,65],"effectiveness":[12],"depends":[13],"on":[14,88],"the":[15],"quality":[16],"of":[17,101],"fuzz":[18,30,56,73],"drivers":[19],"that":[20],"translate":[21],"raw":[22],"fuzzer":[23],"input":[24],"into":[25],"valid":[26],"function":[27],"arguments.":[28],"Automated":[29],"driver":[31,57,74],"generation":[32,75],"reduces":[33],"manual":[34],"effort,":[35],"practice":[38],"often":[39],"produces":[40],"false":[41,66],"positive":[42],"crashes,":[43],"especially":[44],"for":[45,54,115],"complex":[46],"functions.":[47],"We":[48,112],"introduce":[49],"OSS-Fuzz-Gen,":[50],"an":[51],"experimental":[52],"system":[53],"agent-based":[55],"generation.":[58],"This":[59],"paper":[60],"reports":[61],"our":[62,86],"experience":[63],"mitigating":[64],"positives":[67],"using":[68],"two":[69],"complementary":[70],"strategies:":[71],"constraint-based":[72],"context-aware":[77],"crash":[78],"validation":[79],"against":[80],"realistic":[81],"program":[82,106],"entry":[83],"points.":[84],"In":[85],"evaluation":[87],"1,500":[89],"benchmark":[90],"functions":[91],"from":[92],"OSS-Fuzz,":[93],"these":[94],"strategies":[95],"filtered":[96],"out":[97],"more":[98],"than":[99],"half":[100],"crashes":[102],"initially":[103],"classified":[104],"as":[105],"errors,":[107],"at":[108],"modest":[109],"additional":[110],"cost.":[111],"distill":[113],"lessons":[114],"deploying":[116],"LLM-based":[117],"agents":[118],"large-scale":[120],"fuzzing":[121],"pipelines.":[122]},"counts_by_year":[],"updated_date":"2026-07-18T05:58:53.570196","created_date":"2026-07-18T00:00:00"}